FTTH Security Expert

This is a fully remote position, open to applicants anywhere in the world.

📋 Description

• Plan and execute authorized penetration tests focused on FTTH/PON infrastructure, encompassing OLTs, ONTs/ONUs, ODN management systems, and customer premises equipment.

• Analyze the internals of GPON, XG-PON, XGS-PON, and NG-PON2, including OMCI, PLOAM, ONT authentication, and provisioning processes.

• Conduct firmware extraction and reverse engineering of customer premises equipment (CPE) and gateways.

• Evaluate UART/JTAG debug interfaces, hardcoded credentials, update mechanisms, and vulnerabilities in web/CLI management.

• Review subscriber provisioning and management systems such as TR-069/CWMP, TR-369/USP, ACS/OSS/BSS integrations, and zero-touch provisioning methods.

• Examine BNG/BRAS, PPPoE/IPoE, DHCP, RADIUS/AAA, VLAN segmentation, QoS, and subscriber isolation techniques.

• Analyze fixed-mobile convergence, including 5G FWA, shared core, shared OSS/BSS, unified identity, and billing solutions.

• Assess routers, switches, aggregation equipment, NMS/EMS, SNMP, NETCONF/YANG, SSH/Telnet, APIs, and privileged access against established hardening baselines.

• Map attack vectors using MITRE ATT&CK, GSMA FASG/FS.xx guidance, and MITRE FiGHT frameworks.

• Generate prioritized reports featuring proof-of-concept evidence, risk ratings, and actionable remediation strategies.

• Present findings to stakeholders and assist in the verification and retesting of remediation efforts.

• Contribute to the development of internal tools, testing methodologies, lab environments, and reusable attack playbooks.

⛳️ Requirements

• Extensive knowledge of fixed-line network architecture (FTTx, DSL, Coaxial).

• Proven experience conducting security audit penetration tests on OT and IT infrastructure (mandatory).

• Familiarity with FTTH equipment from manufacturers like Huawei, ZTE, Nokia, Ericsson, Calix, or Adtran.

• Understanding of 3GPP SCAS, GSMA NESAS, ISO/IEC 27001, NIST CSF, and ITU-T/BBF specifications.

• Experience in red teaming or adversary emulation targeting critical infrastructure.

• Proficient in English; French language skills are a plus.

• Relevant certifications such as OSCP, OSEP, OSWE, OSED, GPEN, GXPN, GRID, CEH (Practical), eJPT/eCPPT, or CRTO.

• Specialized telecom training, including GSMA, Black Hat/DEF CON telecom, or hardware training.

• Demonstrated contributions through published research, CVEs, conference presentations, or bug bounty achievements in telecom or embedded devices.

🏝️ Benefits

• Fully remote work policy.

• Monthly meetups with department colleagues.

• Entire team gathers on-site every two months.

• Flexible work arrangements that promote work-life balance.